Stravia v0.5.1

Added

• Added standalone Muse Code and Kilo Vendor components. Muse Code supports Meta subscription device authorization, account model discovery, and streaming Responses inference. Kilo supports device authorization, organization selection, model discovery, USD credit-balance allowance, and catalog-selected Chat/Responses inference. Build and locally import their Wasm packages; they are not embedded by default. See Vendor setup and capability limits.
• Saved model services now maintain their inventories at startup and hourly while Stravia is running, including when Desktop is hidden in the tray. Each service has a durable, enabled-by-default automatic-sync preference; manual checks join an in-progress check instead of duplicating discovery. A shared read-only Model changes sidebar shows complete sync batches, specification differences, failures, manual additions and availability-policy changes, with filters, keyset pagination and 90-day retention across restarts, renames and service deletion. See inventory maintenance and management APIs.
• Console Chat now supports original PNG/JPEG/WebP attachments through file selection, paste, and drop, with local persistence and full Responses replay. Messages still require text and an image-capable allowed model. Chat and request observations share safe, bundled math and Mermaid rendering; invalid or unfinished fragments retain readable source. See Console Chat for upstream, Artifact, Debug, and unencrypted local-image retention.
• Added built-in Console Chat to the management UI, with API-Key-scoped streaming, reasoning previews, upstream-reported usage, and locally stored conversation history. See Console Chat for local-storage and transparent-injection limits.
• Added a real HTTP 4×4 ingress/upstream protocol benchmark with streaming and non-streaming delivery, open-loop and fixed-worker loads, large request bodies, per-process CPU and memory sampling, protocol completion checks, and baseline/optimized comparison reports. It exercises the actual Server and SQL storage paths with a local synthetic upstream; measurements are not a guarantee of a final memory target.

Changed

• Updated the pinned Rust toolchain and minimum workspace Rust version to 1.99.0, with CI, release builds, and the Docker builder using the same stable release. Local RUSTUP_TOOLCHAIN overrides remain authoritative.

• Protected reasoning now gets one replay attempt across protocol and signing scopes unless an in-memory rejection is already known. Recovery removes only foreign or unknown payloads, never the current upstream's own payloads, and remembers foreign origins by upstream pair, even when the replay is cut off by a timeout. The replay gets its own full first-token timeout instead of sharing the rejected request's. Devin accepts opaque replay signatures and classifies ambiguous Connect invalid_argument errors as reasoning rejection only before model output (leading model-identity and usage frames do not count) and only with the host's explicit untrusted-payload declaration. Rebuild and re-import Devin; Route retry and failover policy is unchanged.

• Breaking — request parameter injection: Outbound request bodies, session headers, and structured control objects now use explicit native allowlists. OAuth/subscription plugins follow their official tools rather than public API supersets. Unknown controls are silently omitted; arbitrary parameter bags, custom reasoning-field names, OpenCode User-Agent overrides, and generic client-header forwarding are removed. Known controls use typed canonical fields, including one shared structured-output representation for Bedrock. Business tool schemas and permitted arbitrary metadata maps remain intact; authentication, network policy, and account gates remain enforced.

• Breaking — unified request controls: Every request control now has one protocol-neutral field, and vendor-specific controls are gone. Synonyms merge on ingress (n/candidateCount, logprobs/top_logprobs, safety_identifier/user/Anthropic metadata.user_id, thinking display/summary/includeThoughts, thread/window/affinity session IDs), and each target re-derives its official fields, including the Responses include list. Hosted tools are limited to web search, code execution, image generation, tool search, custom, and namespace tools; others such as file search, MCP, computer use, and web fetch are dropped. Search tools from every protocol, including Gemini googleSearch, now go through platform Web Search and return 403 web_search_unavailable when it is not available, instead of passing through to the upstream. Safety controls (Gemini safetySettings, Bedrock guardrails, Cohere safety_mode) and other unmappable vendor options are silently omitted, and function tools keep only strict and defer_loading. Explicit nulls clear inherited values but are never sent upstream. Codex now generates its own installation ID per credential and no longer forwards client beta-feature, subagent, or turn-metadata headers. The generation history namespace moves to v5, so automatic history discovery does not match requests saved before the upgrade; clients that send full history rebuild their chains. Installed format-1 plugins keep reading the old field spellings; rebuild and re-import Codex, Claude Code, Devin, and the other standalone plugins to get the new projections. See ADR-0081.

• Breaking — Rust request interfaces: Request controls and session/header aliases now normalize into one canonical parameter model before target-specific projection. Removed runtime AiRequest.ext, negative parallel-tool aliases, and duplicate reasoning effort/enabled state; hooks, persisted request restoration, hashing, secret protection, and bundled plugins consume canonical semantics. Explicit false, zero, and empty values stay distinct from omission, and explicit nulls become typed parameter resets. The format-1 plugin payload keeps its private legacy projection so installed compatible plugins can ignore future optional fields; WIT and existing persisted payload versions are unchanged. Derived history indexes are rebuilt under the new fingerprint namespace without rewriting immutable history or promoting legacy controls to current exclusion proofs. Unknown source fields do not authorize arbitrary upstream forwarding. See canonical request architecture.

• Refreshed the official client identity pins for standalone Vendors and base's GitHub Copilot allowance requests. Claude Code and OpenCode SDK identity markers follow their corresponding releases, and Command Code allowance, initialization, and inference share one client version. Rebuild and re-import installed standalone plugins to receive these changes; the supported Claude Code client-version override remains available, while removed arbitrary identity overrides are ignored. See client identity versions and verification limits.

• Breaking — Rust protocol interfaces: Removed the shared Devin Connect and Command Code Protocol variants, endpoint constants, and host aliases. Private identities remain exact opaque strings; private codecs own their wire behavior. Opaque/empty endpoint hints now receive canonical inline Artifact bytes, and unknown private thinking sources retain cross-protocol History Marker protection. No database or canonical schema migration is required.

• Vendor channels now declare extra inbound header access through client_header_names. The host retains its public standard-header policy and only grants safe exact names requested by the selected channel; credential and hop-by-hop declarations are rejected, as are invalid header values. No bundled channel currently declares extra headers: Codex session headers are normalized by the host into canonical session fields and projected through native allowlists, not forwarded verbatim. Undeclared installed plugins receive no extra headers. WIT remains stravia:vendor@0.5.0.

• Usage analytics and Request history now share the duration/older/calendar/newer time controls while retaining their separate time rules. Token activity queries earlier durable statistics to fill the visible chart, matches the latency chart's compact height, keeps its date axis and cell details without a separate start/end timestamp row, and uses a right-aligned legend and one color scale across that range. Usage analytics no longer repeats the selected range and historical-recovery notice below its page header. Long selections merge adjacent buckets to fit without truncation or horizontal scrolling; summaries and other charts remain scoped to the selected window. Missing activity buckets display zero, while reported unknown token usage and query failures remain distinct.

• Model checks now return durable server-confirmed summaries and exact history identities. Manual feedback distinguishes nonzero changes, unchanged inventories and saved changes with post-commit errors; background checks remain silent. Imported specifications continue following their source until manually edited, while whole edited specifications and manually registered models remain protected. Existing Targets retain their configuration but subsequent sends respect Effective Availability. SQLite/PostgreSQL migration 0019 adds sync state and retained change history without reconstructing old operations; back up existing databases before upgrading.

• Generation parent routing and Target Continuation preparation now share a small validated parent certificate instead of reloading the chain. Repeated discovery reuses validated common ancestors and external content before SQL restoration under one bounded request-local budget. SQLite/PostgreSQL migration 0017 adds rebuildable, versioned client-history exclusion proofs: SQL skips candidates proven incompatible, including unrelated damaged branches, while possible matches retain full Principal, expiry and canonical-history validation. Rust reusable-prefix metadata/query structs now carry optional projection proofs. Credential mapping publication/retention remains batched within its existing transaction; each History Marker retention call is atomic across all batches. See Generation Chain architecture.

• Breaking — outbound proxy settings: Removed the global proxy switch. The settings page saves one atomic outbound_proxy configuration (URL, bypass, and preserved HTTP/1 preference); model and Web Providers independently select it with use_proxy. Product updates have a separate immediate update_use_proxy preference, including Desktop checks and downloads. SQLite/PostgreSQL migration 0016 preserves effective legacy model routing, leaves Web Provider flags unchanged, migrates the update preference, and removes the four old settings keys; those keys are no longer accepted by the settings API. Catalog and S3 remain direct.

• Explicit outbound proxies now apply host/IP/domain bypass to model HTTP/WS, Web Access HTTP/browser egress, and update redirects/downloads without weakening target authorization or SSRF checks. Unknown proxy schemes are rejected instead of silently connecting directly, SOCKS5/SOCKS5h transport is enabled, and bypass changes invalidate client/WS reuse identity. See outbound proxy architecture and the historical investigation.

• Console Chat user messages now show their send time and offer Copy and Edit. Resending an edit keeps the original images, replaces every later turn, and generates a new answer with the current model and effort. Auto-opened thinking stays open after it finishes, stops, or fails, and collapses only when a later text or tool block starts. The sidebar lists the three most recent conversations, followed by “View more”; on expanded desktop navigation, this group stays open on Chat and All conversations, but otherwise reveals only on hover or keyboard focus and collapses when both leave. Compact and mobile navigation keep their existing behavior. The composer clears on send and stays editable while an answer streams, so the next message can be drafted and sent once the current turn ends; unsent drafts return to an untouched composer. The message box grows to about seven lines and then scrolls.

• Redesigned the Console Chat composer: the API Key sits as a tab above a single borderless, auto-growing input card, and the model/effort picker opens on a localized effort slider (with “Default” as its first stop), with the model list one click away. The header, empty state, and answer actions use compact icon controls, and the send notice below the composer has been removed.

• Console Chat and request observations now share a flat assistant / muted user message layout. Chat has a docked composer, layered model/effort picker, and item-scoped thinking lifecycle; observations retain manual expansion and show tool activity only from execution, handoff, result, and authoritative Run evidence.

• Breaking — usage analytics queries: Replaced hours/tz_offset with paired positive Unix-millisecond start_at/end_at boundaries, aligned to 15 minutes and interpreted as [start_at, end_at); omit both for all-time totals. Series accept optional bucket seconds in multiples of 900 and return the actual bucket_ms, automatically coarsening long ranges to at most 512 points. Usage analytics supports live partial buckets, fixed history, span navigation and local-time custom ranges beyond 24 hours.

• Usage analytics now reads independent durable 15-minute aggregates in SQLite/PostgreSQL. Cleanup of local chats, request history or Debug data, retention changes, deleted configuration and restarts do not erase accumulated statistics. Migration 0018 backfills only retained, identifiable facts; already deleted or never persisted history cannot be recovered. Historical identities remain separate from same-name replacements, without retaining credentials or a permanent request ledger.

• Storage failures, including database, transaction-log and instance-file capacity exhaustion, fail only the owning request or task through existing error paths; Server/Desktop keep serving unrelated work. Independent Observation/Debug writes retain gap/partial without changing inference. No global failure mode, automatic model-call replay or fabricated usage is introduced; destructive cleanup still fails when required usage aggregation is not durable. Existing routing cache and stale/fallback semantics remain unchanged. See the storage-failure contract.

• Usage analytics features a “Latency and speed” chart with independent zero-based axes for time to first token (seconds) and full-call TPS (tok/s). Window summaries and same-bucket tooltips preserve unknown values and real zero output; missing buckets remain gaps. TPS is weighted over successful Target attempts, includes first-token waiting, and requires complete output/duration coverage. Existing observation-record metrics and successful-attempt/request-level sample semantics remain unchanged.

• Replaced the Overview landing page with Console Chat. Traffic, latency, errors, and model/service statistics remain available in Usage analytics; the Overview dashboard and Request Spine have been removed.

• The allowance reset timeline previews up to ten resets within the next seven days, with an expandable full future list. Hover or keyboard focus highlights the matching matrix allowance; clicking or tapping locates it without expanding service details. Forecast totals remain unchanged.

• Breaking: Disposable derived caches now share one logical capacity budget: SQLite uses in-process TinyUFO, while PostgreSQL requires Redis configured before first setup or an existing installation's upgrade. Missing or unreachable Redis prevents PostgreSQL startup; SQL remains authoritative and there is no SQLite fallback. See cache and Server configuration for deployment and upgrade requirements.

• Large canonical request snapshots are now shared across request preparation, observation, and model-turn attempts instead of repeatedly deep-cloning their bodies. History restoration and attachment normalization detach shared requests only when mutation is needed, while retaining upload-grant scrubbing, settings validation, and real media processing. Observation Admission prepares bounded attribution evidence before entering the SQL writer queue, so queued admissions no longer retain full large requests; strict history matching, request delivery, and durable SQL history remain unchanged.

• Vendor request encoding moves owned canonical text and JSON subtrees into Chat Completions, Responses, Anthropic, and Gemini bodies instead of duplicating them through borrowed encoding or parent JSON serialization. Provider wrappers retain only the model, stream, display, or compaction facts needed after encoding. Rebuild and re-import affected standalone plugins to receive the encoding memory reductions.

• Canonical and Chat text-or-content decoding now consumes owned strings and deserializes content sequences directly instead of cloning through untagged Serde buffers. JSON shapes, native tool-result values, arbitrary-precision wire numbers, and malformed-content rejection remain unchanged; the JSON backend remains serde_json.

• Breaking — Rust source interfaces: Canonical MessageContent::Text and ContentBlock::Text.text now use Arc<String>; text edits detach shared buffers, and Hook contexts and unchanged request actions retain shared snapshots. Full Hook snapshots are constructed only for eligible Request subscribers; response/stream processing and platform-tool permissions retain their existing contracts. Execution and continuation interfaces also carry shared requests or already encoded SDK inputs. ProtocolAdapter::encode_request, ProtocolPair::encode_request, ProtocolTransform::encode_request_with, and shared Vendor request encoding now consume AiRequest; Rust callers must transfer ownership and explicitly clone only when retaining the request. All bundled callers are migrated. HTTP, stored JSON, canonical hashes, payload versions, and the WIT ABI are unchanged; compatible installed plugin binaries remain executable.

• SQLite and PostgreSQL prepare history JSON, hashes, and missing-content compression on blocking workers before the ordinary write transaction. Existence hints are rechecked under the existing write/GC locks, with stale-hint recovery and atomic content references preserved. Confirmed existing content releases recovery buffers, and missing compressed buffers transfer into SQL parameters rather than remaining duplicated across database waits. Repeated raw history items are fingerprinted before allocating duplicate serialized bodies. Interaction usage aggregation follows the existing indexed Run relationships instead of scanning all historical attempts, preserving SUM, null, zero, and replay semantics. No schema migration, retention change, or history omission is required.

• Private canonical and provider JSON encoding allocates buffers to the serialized length, and history hashing streams JSON bytes rather than retaining a full encoded buffer. Plain-text history hashes and equality borrow canonical text; complex native/content projections retain their exact semantics, JSON ordering, and length-prefixed hashes. Canonical projections move owned JSON subtrees instead of reserializing them, and Responses ingress moves owned top-level input text rather than cloning it. Observation previews check the complete text before Unicode-safe truncation, borrowing unchanged text and retaining only the final preview. Bounded diagnostic tails reject provably oversized ordinary text before copying it, preserving private-control projection, suffix capture, and full generation history.

• Wasmtime execution transfers canonical inputs into owned lowering, releasing host payload buffers after copying them into guest memory instead of retaining them across upstream waits. Calls still use separate Stores, the synchronous WIT ABI is unchanged, and guest component async/threading extensions remain disabled.

• The complete local Windows test matrix now provisions isolated Redis alongside PostgreSQL. PostgreSQL E2E also requires STRAVIA_TEST_REDIS_URL pointing to a dedicated test instance.

• Protocol conversion now defaults to omitting anything the destination protocol cannot express across requests, responses, streaming deltas, and continuation history, including controls, content, extensions, and hard constraints. Representable fields remain intact; there is no strict-mode toggle or whole-conversion rejection solely for semantic loss. This can lose images, tool calls and related results, hard constraints, extra candidates, or history, and is not lossless. Object-only tool destinations omit unrepresentable calls and related results rather than fabricating {} or stringifying unsupported content; omitted deltas retain representable text without creating a failed terminal state. Reported usage stays real, never synthetic zeroes. Malformed source input, parsing, safety/credential checks, and network/upstream errors remain errors. See ADR-0006. Rebuild and re-import affected standalone plugins to receive the change.

• Connect Client Apply writes compat.supportsStrictMode: true on the OMP stravia provider, so OMP sends schema-adapted strict: true tools instead of omitting strict, which Responses upstreams auto-strictify with optional parameters made required. Re-apply the OMP configuration to receive it.

Fixed

• Fixed OpenAI Codex requests failing with Open Responses SSE sequence_number N does not match N-1. Numbered response.metadata events now advance stream sequence validation without emitting output deltas; Codex WebSocket responses use the shared decoder so these events reach the parser. Rebuild and re-import the standalone openai-codex component.
• Aligned workspace Rust formatting with the pinned Rust 1.99.0 toolchain so CI static checks pass the formatting gate; runtime behavior is unchanged.
• Codex WebSocket continuation now reuses the matching connection across client tool-result turns instead of reporting a local continuation_unavailable and replaying full history every time. Handshakes use stable thread correlation; changing turn metadata and same-turn routing state stay in each response.create message. HTTP correlation and the host's credential, account, Principal, Target, and exact-tip checks are unchanged. Rebuild and re-import the standalone openai-codex component.
• Expired observation cleanup no longer holds one unbounded deletion transaction that can block SQLite History Marker writes and fail an active response with database is locked. SQLite/PostgreSQL migration 0020 adds missing cleanup foreign-key indexes and ordered expiry indexes; retention now commits bounded batches and invalidates their live state immediately, preserving completed progress if a later batch fails. Existing lock timeouts, active-record eligibility, manual-clear protection, and durable usage totals are unchanged. Back up existing databases before upgrading.
• Codex HTTP and WebSocket inference no longer request unsupported output logprobs when clients send logprobs or top_logprobs, including zero, avoiding upstream 400 / logprobs are not supported with reasoning models. rejections. Reasoning effort and encrypted reasoning remain intact; standard API logprobs support is unchanged. Rebuild and re-import the standalone openai-codex component.
• Fixed OpenCode Zen Free inference using the current /inference/v1 default endpoint, a captured and live-verified OpenCode client identity, native time-encoded session/message IDs, and non-empty official tool input schemas. Client tools remain unchanged; missing compatibility declarations carry explicit no-call instructions, not tool executors. Complete client tool sets also normalize native tool choice. Rebuild and re-import the component, and update explicitly saved legacy /zen/v1 Base URLs. See verification and access limits.
• Codex uses its required native streaming wire even for non-streaming clients, which still receive host-aggregated responses; compact remains non-streaming. HTTP continuation restores full history before dispatch instead of dropping a WebSocket-only response ID while retaining delta input. Native session lineage uses the same Principal/Target scope as the referenced parent identity without granting continuation access. OpenRouter receives only its documented host-scoped session header; unrelated API profiles receive none.
• Devin's scoped native sessions retain the confirmed supported controls. Claude Code omits optional strict grammar annotations when tool schemas exceed the native grammar budget, preserving nullable schema types and history instead of rewriting schemas. Codex reconstructs native session headers and body metadata from the same target-scoped identity without reusing arbitrary inbound aliases, and omits metadata and prompt_cache_retention rejected by its private endpoint while retaining supported cache-key and parallel-tool controls. Rebuild and re-import the affected standalone components; these changes do not alter Route retry or failover policy.
• Request-history conversations no longer repeat a user message for exact client retries after an uncommitted failure, including retries with different per-attempt correlation IDs, retries grouped through a pending client tool result and requests larger than the diagnostic input window. Full semantic request identity, Principal and session isolation, the existing two-minute retry window and concurrency guards determine suppression; genuine new input and every failed Run remain visible in their respective views. Existing persisted observations are not rewritten.
• Shared WebUI dependency installation and asset generation now run once per Task invocation, so parallel Admin and WebUI E2E preparation branches wait for the same locked Bun install and build instead of racing over workspace links and generated files. Allowance guard lifecycle fixtures now answer every allowance read in the current response phase until GET completes, avoiding unanswered requests and stale recovery responses without changing production refresh or timeout behavior.
• Allowance guard toggles now confirm the local save without waiting for an upstream allowance request. The UI distinguishes saving from background refresh, keeps confirmed guards editable while refresh runs, and applies fresh allowance evidence when it arrives; removing the last triggering guard clears the persisted pause immediately. Breaking — management API: PUT /api/v1/provider-allowances/{id}/guards now returns { keys, target } rather than a post-refresh snapshot. Single-provider GET joins the registered refresh. No database migration or upstream timeout change is required.
• Observation no longer merges a side request (for example an agent's progress-check) into the main Interaction through the two-second rapid-continuation rule when its parent Generation node was already continued. It now becomes a child Interaction, so the main Interaction's preview, usage and activity time are no longer polluted. See interaction observation.
• OpenAI-compatible JSON-schema response formats now retain their protected description alongside canonical name, schema and strict controls instead of losing the description during encoding. Rebuild and re-import affected standalone Vendor plugins to receive the fix.
• Admin and Chromium CI now prepare isolated test-host server artifacts and use the standard E2E tasks, avoiding missing server binaries and rejected test-only catalog arguments. Compaction and media-protection regressions now distinguish unsupported standalone operations from inline protocol omission and verify content semantics without requiring an incidental string carrier.
• Devin's daily and weekly allowance windows no longer disappear when exhausted: the plugin recognizes an omitted zero remaining percentage when the upstream still reports the window's reset time, while leaving unreported windows absent. Rebuild and re-import the standalone devin plugin, then refresh allowances; existing guard keys and account configuration remain unchanged.
• Removed Core's unused windows-sys 0.52 build dependency and obsolete workspace alias. Retained verified host/target feature-unification dependencies; other package features and runtime Windows APIs remain unchanged.
• Removed redundant search URL parameter borrows and placed search configuration/policy tests after production items to satisfy strict Clippy checks. URL encoding, response parsing, and persisted search-policy behavior remain unchanged.
• Cross-protocol request pruning now preserves verified target-native extensions and Responses compaction state instead of discarding them solely because the client ingress differs. Anthropic client histories, combined assistant/tool turns, and equal provider-visible redacted histories again retain native Responses continuation; parent, target, history, expiry, and security checks remain unchanged. Unsupported target state is still omitted. Rebuild and re-import affected standalone plugins.
• Representable protocol fields are now converted instead of being lost alongside unsupported siblings: Anthropic structured output, supported tool controls, and document/file sources; Gemini JSON-schema output and tool-parameter carriers, sampling controls, and native candidate identities; and mixed document/tool-result text, media, and business JSON. Devin and Command Code own their private-wire projection locally, preserving native replayable thinking and supported history without adding private capability tables to the shared standard converter. Rebuild and re-import affected standalone plugins.
• Claude Code requests no longer end in unsupported assistant prefill on Claude 4.6 and later, or when thinking is enabled. The plugin omits the unsupported trailing assistant messages while retaining prior assistant history and completed tool calls/results; it does not relabel assistant content or insert a synthetic user prompt. Legacy non-thinking prefill remains supported. Rebuild and re-import the standalone claude-code plugin to receive the fix.
• Breaking: Vendor plugins now require stravia:vendor@0.5.0 and must be rebuilt and re-imported with the updated host (0.4.0 Components are rejected; no compatibility layer). ws-request gains an optional reuse-max-age-millis, letting a plugin cap how long a pooled WebSocket may be reused after its handshake; the host applies it generically, never above its 60-minute limit, without extending a connection's age. The Codex plugin declares 55 minutes to stay clear of the upstream one-hour lifetime: idle connections are released proactively, an in-flight response finishes under the existing limit but is not returned to the pool, and later requests reconnect with full history rather than reusing a connection-local response ID. Configuration, credentials, client APIs and database schemas are unchanged.
• Responses truncation: "auto" and "disabled", whether inherited or explicit, now follow the same destination-support policy: supported values are preserved and unsupported controls are omitted rather than causing local vendor_request_invalid. Anthropic receives no truncation control; Stravia does not automatically trim history, and upstream context-overflow errors remain errors. The automatic-truncation intent is not guaranteed after omission. Rebuild and re-import affected standalone plugins, including claude-code, to receive the codec change.
• Automatic and manual model discovery now share a bounded 120-second budget instead of the short 30-second limit, allowing slow account catalogs such as Devin's to finish. Manual checks still join an active background discovery without a duplicate upstream request; shutdown cancellation and inventory publication checks remain unchanged.
• Allowance-pause details no longer expand model-service table rows or allowance-matrix rows. The list, service header and matrix now use a compact status trigger with hover, keyboard and touch-accessible details; the routing-recovery explanation has been removed.
• A confirmed account inventory is no longer rejected because optional Provider Catalog enrichment fails. The catalog failure remains explicit; existing catalog specifications and reimport sources remain valid, and missing lifecycle metadata cannot clear deprecation. Canonical or unregistered metadata never adds inventory members.
• Desktop and Server now cancel background discovery before draining HTTP on full exit, so an active manual model check cannot hold shutdown open while waiting for its own cancellation. Final task, observation and cache cleanup keeps its existing order.
• Manual model-check detail actions remain usable after switching tabs or pages, including keyboard activation and focus recovery at 320px. Completing a check no longer navigates users back to a page they left, and late automatic-sync preference responses cannot overwrite another service's state.
• Shared request-deadline waits use remaining real time rather than converting absolute instants across clock domains, so controlled Gateway schedule tests can advance an hour without spinning or shortening discovery deadlines. Renewal and cancellation semantics remain unchanged.
• Fixed Desktop/Server startup spending excessive time rebuilding old Generation history indexes. SQLite/PostgreSQL now decode shared ancestors once in parent-first order and fold client-history hashes incrementally, without rewriting immutable history, changing expiry or retaining full-history caches. The Rust TurnChainStore::rebuild_prefixes callback now receives one node and its optional original completion time; stale-index updates remain atomic.
• Canceled or timed-out Chrome renders now attempt to stop loading before their single target-close attempt. If Chromium rejects the stop during a native main-frame transition, one context-independent renderer round-trip waits for navigation commit or abort before closing, within the original shared cleanup budget. Proxy guards, Cookie/context isolation, request deadlines, and process/profile-reaping policy remain unchanged.
• Diagnostic-event failures no longer roll back adjacent usage updates in the Observation writer. Genuine usage persistence loss still blocks related destructive history cleanup; storage errors remain local to the owning request or task, including capacity exhaustion.
• OpenAI-compatible streaming usage now preserves omitted counters while applying later reported values, including explicit zero. Partial corrections and duplicate cumulative reports no longer leave stale output usage in observations or durable statistics. Rebuild and re-import affected standalone Vendor plugins to receive the parser fix.
• Successfully delivered streaming completions retain their Generation history when a client closes at the protocol terminal without reading HTTP EOF. Later caller cancellation or deadline expiry cannot undo confirmed publication; actual Vendor revocation still blocks result-derived writes, while necessary persistence failures are reported locally rather than shutting down the instance. Failed protocol terminal frames remain failed.
• Latency/TPS help remains readable after tapping its trigger instead of closing on the synthesized click. Keyboard focus, Escape, outside dismissal, and desktop hover remain supported.
• Test artifact preparation respects CARGO_TARGET_DIR, allowing isolated validation without replacing a running local instance. Concurrent Rust and storage workers use separate PostgreSQL databases; the migration-failure fixture also owns a temporary database and requires CREATEDB. Native host storage-failure acceptance runs after WebDriver cleanup without waiting for unrelated suites, covering local errors, continued service and protected cleanup through isolated SQLite-full and fixed PostgreSQL Stats-write fault fixtures; these fixtures are test-only and do not exhaust the physical disk. Acceptance fixtures wait for durable terminal facts, exercise actual candidate overflow, and establish paused browser clocks before application timers start. Migration locks, test coverage, and the five-minute full-matrix budget are unchanged.
• Admin model-sync CI fixtures now select direct connections when no outbound proxy is configured, preserving the production error for explicitly selected but unconfigured proxies. Rust icon formatting checks are restored, and icon tests no longer depend on an internal SVG marker name.
• Restored WebUI CI formatting checks and aligned service-card logo regressions with local SVG precedence. Browser coverage still verifies remote-logo loading and visible fallback when no built-in icon is available; runtime logo selection is unchanged.
• Markdown in Console Chat and request observations now closes bold/italic emphasis next to CJK text, such as **名称（别名）**之后, which CommonMark previously left as literal asterisks. Emphasis follows the CJK-friendly CommonMark draft via marked-cjk-friendly.
• Console Chat no longer shows empty “Thinking” blocks for reasoning items whose summary is blank, whitespace-only, or only hidden comments, during streaming, after completion, or after stop/failure. Signed reasoning items are still stored and replayed unchanged.
• The navigation sidebar now highlights only one Chat item at a time: the open recent conversation, “All conversations”, or Chat itself when no more specific item is visible.
• CI regressions now follow the current contracts: Vendor conversion coverage follows omission of unrepresentable tool calls and constraints while retaining malformed-source and safety failures; the protocol matrix waits for persisted run_finished at its fixed event watermark; Windows desktop smoke covers Console Chat at the landing page, charts in Usage analytics, and persistence after a new authenticated document has loaded. Native clipboard assertions explicitly require real WebView foreground focus without granting additional window permissions. WebUI/Rust formatting and warning-free static checks are restored; compatibility policy is unchanged.
• SQLite performance attribution tests now release worker-held spans before exporting telemetry, preserving exact query counts and avoiding incomplete samples caused by the test's debug shutdown.
• Function tools from Chat Completions or Anthropic Messages clients that omit strict are now sent to Open Responses targets with explicit strict: false, so upstream no longer auto-strictifies them and turns optional parameters into required ones. Both owned and borrowed request encoding preserve this default. Chat Completions targets now preserve explicit strict. Rebuild and re-import affected standalone plugins (for example openai-codex) to receive the fix.
• Antigravity thinking controls now follow the observed official CLI 1.3.2 contract: selected effort variants apply their catalog thinkingBudget, native thinkingLevel uses the private enum values, and valid explicit controls are no longer silently discarded. Public-thought summary selection remains independent; signatures alone are not displayed as thought text.
• Management input values consistently show net input, summing max(total input - cache read, 0) per attempt across statistics, observations, chain filters, and Debug Bundle summaries. Console Chat also subtracts reported cache reads before saving input usage; its local-history upgrade removes unconvertible old input metrics while preserving messages, reasoning, replay items, output usage, and preferences. Unknown operands remain unknown; input labels and independent cache metrics are unchanged. Raw storage, exported events, protocol usage, pricing, and scheduling inputs retain their existing contracts.
• Responses item-completion events now follow final output order and preserve authoritative native payloads, so clients that save history in completion order can reconnect to the same conversation chain. Ordinary content deltas and reasoning-summary part boundaries remain immediate; strict history matching is unchanged.

---

Full Changelog: v0.5.0...v0.5.1